Lojack for Laptops

Companies lose billions of dollars a year in hardware and data. Here's how the good guys try to get the stuff back.

By
Arianne Cohen

Allow me, for a moment, to predict the future: Your company is going to lose a lot of money on laptops. It's inevitable. A laptop is stolen every 53 seconds. More than 12,000 laptops disappear weekly from U.S. airports alone. Only 3% of stolen laptops are ever returned. According to the Computer Security Institute, the average large company lost almost $3.9 million last year to laptop and mobile-device thefts, and another $4.5 million on the proprietary and confidential data stored in those machines. Throw in the expense of offering free credit reporting to customers whose data was accidentally exposed, and corporations spend an estimated $5.4 billion annually.

Grant Thornton, the 6,000-person accounting firm, knew those numbers all too well. "We have one laptop per employee, and we'd had some break-ins and thefts," says director of IT David Johnson. Like most companies, many more laptops disappeared internally: The same laptop is transferred to four employees over three years, and suddenly (whoops!) no one knows where it is. "You can't really consider security if you don't know what you have and where it is," he says. "We lease our computers from Lenovo. When it asks where every item is — and we pay a fee if we don't know — you begin to care a lot."

The tonic comes from a 15-year-old Canadian company called Absolute Software. It has developed software that lives in a notebook computer's motherboard and pings Absolute's headquarters with its online IP address. The daily pings let companies keep up-to-date lists of where their computers are around the world and notify them if a ping comes from an unexpected location. Customers can trigger a code to wipe a machine's hard drive from afar.

The technology is called Computrace, and in the past 18 months, it has become the industry standard for dealing with theft. Computrace is now included in the motherboards of all major manufacturers' notebook computers, including Dell, Lenovo, HP, Panasonic, and Toshiba. Absolute has 3 million customers, mostly corporate, but also NASA — for whom it retrieved two laptops, carrying training-mission data, that had been stolen in Russia — and the Los Angeles Unified School District. A three-year contract for a single unit costs $99, though companies pay a much lower bulk rate.

Absolute had the idea a decade ago, but it didn't catch on until the company devised a clever strategy for making sure that it could do something with the incriminating information it possessed. "We hired 30 full-time former police officers around the country to work with law enforcement in the jurisdictions where laptops might pop up," says CEO John Livingston, who has trained officers in the 20 largest U.S. cities.

The strategy has made the business. A burglar broke into one of Grant Thornton's Florida offices and made off with a number of computers. A week later, one of the units pinged in from a Florida mall. Absolute informed the local precinct. Officers went to the address and found a mall phone store selling stolen property — including the rest of the stolen PCs. "Of the few dozen that are stolen every year, 80% are recovered," says Grant Thornton's Johnson, "and with the pinging service, we return more than 99% of the laptops on our lease." Overall, Absolute's partnership with law enforcement has yielded a 75% recovery rate on stolen laptops.

Which is why, on a Tuesday afternoon this past summer, Mike Perez, a former NYPD detective and one of Absolute's regional managers, is training 16 detectives at Newark Police headquarters on how Absolute's technology works. Perez presents a slide show, first dispelling the myth that Computrace is a GPS system like LoJack for cars. It's not, although Absolute's consumer version has adopted the LoJack name. (The companies are unrelated, but Absolute's next service will use GPS to locate smartphones and laptops equipped with an internal cellular modem.) Absolute tracks only IP addresses, which requires waiting until the laptops are connected to the Internet. Although that's not ideal, more than 90% of stolen laptops end up online within days or weeks after being stolen.

The room is particularly interested in the fact that up to 10% of Absolute's cases overlap with other crime — weapons, drugs, stolen vehicles, credit-card scams. And Absolute has the tools that make cops very happy. Perez flashes a snapshot of a guy holding a gun in a backyard, then another photo of bundles of cash. Perez can see a stolen computer's screen in real time, meaning that he can grab screen shots of what's going on. He can also monitor keystrokes.

As a result, criminals often lead the cops to their own door. Thieves will try a Google search like where to sell a stolen laptop, Jay Street, Newark NJ. Or they'll post a Facebook update: Travis is enjoying his new computer. "We get subscriber records through the IP address, and then run them through popular sites," Perez says. "Facebook, WhitePages.com, Hi5, and Google, for instance. We often get a photo." Perez's partner, Marty Davin, assures the room that these leads are passed on: "We want to make sure the investigator has as much information as possible so that when he arrives on the scene, he's prepared."

Perez uses full-on cop speak to highlight the low-fuss benefits Absolute can offer. "We try to minimize the time you allocate to laptop theft," he says. "If you got a homicide but are also tracking a laptop, you can call us and ask, 'Hey, you got a guy in Newark?' We'll email or fax you the data, and your warrant support forms, ready to go for the prosecutor's office." The room nods. This is like Christmas.

As the seminar ends, Detective Larry Collins, a 13-year veteran, pulls the officers aside to tell them about a laptop case he's working on. A few days later, Collins gets a call from Perez. "He said, 'That laptop you mentioned came back online, and this is where it's being used,' " Collins says. "We went right over to the address Absolute gave us, and recovered the laptop. The owner had just bought it and had no idea it was stolen. It took 20 minutes. I wish every investigation were that easy."

A version of this article appeared in the November 2008 issue of Fast Company magazine.

Enterprise and Government customers may be interested to learn that Absolute Software is a member of McAfee's Security Innovation Alliance (www.mcafee.com/sia). Absolute is integrating Computrace with McAfee's Security Management system called ePolicy Orchestrator (ePO).

McAfee's Cybercrime initiative also benefits from Asolute's partnership with law enforcement because in many parts of the world, possession in 9/10th's of the law! (www.mcafee.com/us/about/corpor...

Further thwarting bad guys is Computrace embedded BIOS support, which allows the Computrace agent to survive operating system re-installations, hard drive reformats and even hard drive replacements. A list of Manufacturers, Makes, and Models is at http://www.absolute.com/produc...

Caution: the 'wipe' to your hard drive is good for amateur thiefs, but won't prevent serious hackers or espionage from retrieving your data. Self-encrypting hard drives is a solution from Dell, HP and Lenovo on their secure PCs.

Another solution is GadgetTrak ( www.gadgettrak.com ) which not only protects your laptop but does it in a privacy safe fasion. In addition GadgetTrak provides software for mobile phones and other portable media devices.